Captivo Access changelog — 2026 · Page 12 of 13

What changed

• New: Guided Update command for outdated connectors

What changed

• New: Show guided upgrade commands when a newer version is available
• New: BuildConnectorUpdateCommand for in-place connector updates

What changed

• New: Render all timestamps in the viewer's timezone and locale (LocalTime)

What changed

• New: Admin update banner + Updates settings page
• New: GitHub release check route + toggle route
• New: UpdateCheckConfig singleton + config lib (additive)
• New: Flag connectors older than the manager
• New: Expose manager build version + semver comparison helpers

What changed

• Fixed: Add defense-in-depth security hardening for websocket handler
• New: Websocket passthrough handler (shared egress validator + raw relay)
• New: Add WsDialRequest/WsDialResponse frames for websocket passthrough

What changed

• Fixed: Separate passkey and SSO buttons with an or-divider and clear hierarchy

What changed

• Fixed: Verify id_token iss against the discovery issuer (fixes Auth0 trailing-slash mismatch)

What changed

• Fixed: Use managerBaseUrl for OIDC browser redirects; log the specific failure reason

What changed

• Fixed: Ignore a search query shorter than 2 characters
• Fixed: Atomic rename (404 on raced delete) and de-dup the run command
• Fixed: Reject non-string note (400) and map edit errors to specific messages

What changed

• Fixed: Guard re-pair rotation against REVOKED status (un-revoke race)
• New: Re-pair action in the connectors list
• New: Re-pair route with optional immediate token invalidation
• New: Redeem a pairing into an existing connector (token rotation)

What changed

• Fixed: Add defense-in-depth try-catch to getSmtpConfig
• New: Persist and show last-verified for SSO and SMTP tests
• New: Add inline deny reason input to decision buttons
• New: Optional deny reason, shown to the vendor

What changed

• Fixed: Don't allow revoking your own current session from the sessions page
• Fixed: Narrow eslint disable to specific mount-effect line
• New: Free-text search and URL-reflected filters
• New: This-device indicator and bulk-revoke (self-guarded)
• New: Rename a connector inline
• New: Edit an active grant's end date and note

What changed

• Fixed: Final-review fixes for withdraw race, silent failures, dead field
• New: Admins can change a user's role (self-guarded)
• New: Unread styling, per-row mark-read, and site links
• New: Test IdP connection button (OIDC discovery reachability)
• Fixed: Atomic cancel-invite delete + use row-actions class
• New: Admins can cancel a pending invite
• New: Vendors can withdraw a pending access request

What changed

• New: Add browser titles for the dashboard and recovery pages
• New: Reusable CopyButton on the DNS record and Site addresses
• New: Aria-current on active nav; focus-trap + listbox semantics in the command palette
• New: Per-page browser titles; single heading source; consistent section-heading size
• New: Themed confirm for delete-passkey and remove-recovery too
• New: Use the themed confirm dialog for all destructive actions
• New: Themed ConfirmDialog + useConfirm hook (focus-trapped, Esc/Enter)
• New: Design-language loading, error, and not-found states for the console
• Fixed: Fire up/down notifications on a manual Test connection, matching the cron
• New: Pure filterUsers helper (search + status + role) with tests
• Fixed: Default the recurring-hours timezone to the browser zone, not Istanbul
• Fixed: Test connection refreshes the persisted health probe

Sign in with your identity provider — SSO via OIDC (Microsoft Entra, Google Workspace, Okta), alongside passkeys.

Highlights

Until now the only way into the console was a passkey. This release adds single sign-on for your internal team, so Admins, Operators, Auditors, and Staff can sign in with your organization's identity provider — and MFA is handled by that provider.

• Generic OIDC. One integration covers Microsoft Entra / Azure AD, Google Workspace, Okta, Auth0, Keycloak — anything that speaks OpenID Connect. Configure it under Admin → Single sign-on: paste your issuer URL, client ID, and client secret, and copy the shown redirect URI into your IdP app.
• Alongside passkeys, never instead of. The login page keeps the passkey button. SSO is additive, so a broken or misconfigured IdP can never lock everyone out — keep at least one passkey admin as break-glass.
• Invite-based, controlled access. SSO doesn't auto-create accounts. A person can sign in via SSO only if an admin has invited their email (or they already have an account); the role is always the admin's explicit choice. Uninvited identities are rejected. Vendors continue to use passkeys (they're external and not in your directory).
• Security-first. Every sign-in is verified end to end — the ID token's signature (JWKS), issuer, audience, expiry, nonce, and a verified email are all checked before a session is created; the client secret is encrypted at rest and never leaves the server; PKCE is used on every flow.

Upgrade

• Manager-only, non-breaking. Pull the new manager image and restart. (dataplane/connector re-published at 0.8.0 for version parity, identical to 0.7.6.)
• Run prisma db push to add the new OidcConfig table — additive and non-destructive. Existing passkey login is unaffected whether or not SSO is configured.

Images

Published to GHCR, tagged 0.8.0 and latest:

```bash

docker pull ghcr.io/kurtserdar/captivo-access-manager:0.8.0

docker pull ghcr.io/kurtserdar/captivo-access-dataplane:0.8.0

docker pull ghcr.io/kurtserdar/captivo-access-connector:0.8.0 # amd64 + arm64

```

New here? Install guide — a complete worked walkthrough from a bare server to your first vendor connected. License: Apache-2.0.

Add a vendor app with one DNS record — TLS is now automatic, no API token, any DNS provider.

Highlights

Setting up HTTPS for each vendor app used to mean either a wildcard certificate (which needed a DNS-provider API token — Cloudflare/deSEC only, not e.g. GoDaddy) or a separate config block per app. This release makes it effortless:

• One wildcard DNS record covers everything. Point *.<your-access-domain> at your server once. Every current and future app subdomain resolves automatically — no per-app DNS.
• Automatic per-app TLS via On-Demand certificates. With the shipped Caddy stack, each app's certificate is issued the first time it's opened, over HTTP-01 — no DNS-provider API token, works with any DNS provider. Caddy asks the manager before issuing, so certificates are only ever created for hostnames that are configured Sites.
• New "Custom domain" console page. Admins get the exact DNS record to create (with your server's address filled in) plus a Verify DNS button that checks the record is in place — no more guessing or command-line dig.

Result: adding a new app is just create the Site in the console — DNS and TLS take care of themselves.

For very large deployments that would exceed Let's Encrypt's per-domain new-certificate rate limit, the single-wildcard-certificate path (via a DNS-provider token) remains available as a documented escape hatch.

Upgrade

• Manager + front-proxy update, non-breaking, no database change. Pull the new manager image and restart. (dataplane/connector re-published at 0.7.6 for version parity, identical to 0.7.5.)
• Self-hosters on Caddy: the shipped deploy/Caddyfile now enables On-Demand TLS by default on the stock caddy:2-alpine image — just add the *.<domain> A record. See deploy/README.md → "Wildcard TLS".

Images

Published to GHCR, tagged 0.7.6 and latest:

```bash

docker pull ghcr.io/kurtserdar/captivo-access-manager:0.7.6

docker pull ghcr.io/kurtserdar/captivo-access-dataplane:0.7.6

docker pull ghcr.io/kurtserdar/captivo-access-connector:0.7.6 # amd64 + arm64

```

New here? Quickstart — a working demo in ~5 minutes with zero DNS. License: Apache-2.0.

Three new roles — Operator, Auditor, and Staff — so you can grant the right level of access, not just "admin or vendor."

Highlights

Until now every account was either a full Admin or a connect-only Vendor. This release adds three fixed roles between and beside them:

• Operator — manages access grants (approve, deny, revoke, create) and can view the console, but can't touch infrastructure (connectors, sites, users, SMTP, sessions). For day-to-day access approvers and help-desk staff.
• Auditor — read-only across the console: the audit log (with CSV export), sites, and grants — but no changes. The grants page is visible read-only, with the approve/deny controls hidden. For compliance reviewers.
• Staff — an internal employee with the same connect-only access as a Vendor, but a distinct identity. "Vendor" is for external suppliers; "Staff" is for your own people. The distinction also shows up in the audit log alongside the Company column, so you can tell at a glance whether an action came from an external vendor or internal staff.

Connecting to an internal app is still governed by access grants and is independent of role — any role, including Admin, connects only where it's been granted. The new roles simply control what each account can do in the admin console.

The Users and Invites screens now let you assign any of the five roles, and the sidebar, command palette, and dashboard adapt to what each role can actually do.

Upgrade — one migration step

• Manager-only, non-breaking. Pull the new manager image and restart it. No connector/data-plane change. (dataplane/connector re-published at 0.7.5 for version parity, identical to 0.7.4.)
• Run prisma db push to add the three new Role values (OPERATOR, AUDITOR, STAFF) — additive enum values, non-destructive. Existing Admin/Vendor accounts are untouched and behave exactly as before.

Images

Published to GHCR, tagged 0.7.5 and latest:

```bash

docker pull ghcr.io/kurtserdar/captivo-access-manager:0.7.5

docker pull ghcr.io/kurtserdar/captivo-access-dataplane:0.7.5

docker pull ghcr.io/kurtserdar/captivo-access-connector:0.7.5 # amd64 + arm64

```

New here? Quickstart — a working demo in ~5 minutes with zero DNS. License: Apache-2.0.

Audit log now shows each vendor's company.

Highlights

• Company column in the audit log. Alongside the user's name and email, each entry now shows the company the vendor belongs to — so you can see at a glance which organization an action came from. Entries without a company show "—". The value is captured at the time of the event (a snapshot), and it's included in the CSV export too.

Upgrade — one migration step

• Manager-only, non-breaking. Pull the new manager image and restart it. No connector/data-plane change. (dataplane/connector re-published at 0.7.4 for version parity, identical to 0.7.3.)
• Run prisma db push to add the new AuditEvent.company column — additive and non-destructive. It does not affect the tamper-evidence hash chain (like name/email, company is a display-only snapshot and is not hashed).

Images

Published to GHCR, tagged 0.7.4 and latest:

```bash

docker pull ghcr.io/kurtserdar/captivo-access-manager:0.7.4

docker pull ghcr.io/kurtserdar/captivo-access-dataplane:0.7.4

docker pull ghcr.io/kurtserdar/captivo-access-connector:0.7.4 # amd64 + arm64

```

New here? Quickstart — a working demo in ~5 minutes with zero DNS. License: Apache-2.0.

Console polish — names in the audit log, resend an invite, clearer email settings.

Highlights

• Names in the audit log. Each entry now shows the user's name alongside their email, so you can tell at a glance who did what. (Older entries show the email only.)
• Resend an invite. A pending invite can be resent — it mints a fresh single-use link (the old one is replaced), emails it when SMTP is on, and shows the new link once. Handy when the first one was lost or expired.
• Clearer email settings. The test-email button now tells you the real problem — "email is saved but turned off, tick Enabled" versus "configure SMTP first" — instead of a generic message, and you can pick which address the test goes to.

Upgrade — one migration step

• Manager-only, non-breaking. Pull the new manager image and restart it. No connector/data-plane change. (dataplane/connector re-published at 0.7.3 for version parity, identical to 0.7.2.)
• Run prisma db push to add the new AuditEvent.userName column — additive and non-destructive.

Images

Published to GHCR, tagged 0.7.3 and latest:

```bash

docker pull ghcr.io/kurtserdar/captivo-access-manager:0.7.3

docker pull ghcr.io/kurtserdar/captivo-access-dataplane:0.7.3

docker pull ghcr.io/kurtserdar/captivo-access-connector:0.7.3 # amd64 + arm64

```

New here? Quickstart — a working demo in ~5 minutes with zero DNS. License: Apache-2.0.

Self-signed internal apps, editable sites, one-click access — plus fixes from real-world deployment.

Highlights

• Serve self-signed HTTPS apps. A Site can now skip TLS certificate verification on the connector→app leg — a per-Site toggle (off by default) for internal devices with self-signed certs (printers, appliances, admin UIs).
• Edit & delete sites. Sites are no longer create-only: edit any field (including the connector and the skip-TLS toggle) from an Edit page, and delete a site (with a confirmation that shows how many access grants it will remove).
• One-click "Open" on My access. Each active grant on a user's My access page gets an Open ↗ button that launches the app in a new tab — no need to type the URL.
• Multi-arch connector. The connector image is now published for arm64 as well as amd64 — native on Apple Silicon, Raspberry Pi, and ARM servers (no emulation).

Fixes

• Passkeys behind a subdomain. WebAuthn now accepts an RP-ID that is a registrable suffix of the origin host, so a console served at manager.<domain> with WEBAUTHN_RP_ID=<domain> works (previously it failed with an origin mismatch). This is the documented multi-subdomain setup.
• Connector version. The connector now reports its real release version (it was hard-coded to 0.1.0 regardless of the image).

Upgrade — one migration step

• Pull the new images and restart. The connector gained an additive tunnel field; there's no lockstep required, but pull manager, data-plane, and connector together to use the new skip-TLS toggle.
• Run prisma db push to add the new Site.insecureSkipVerify column — additive and non-destructive.

Images

Published to GHCR, tagged 0.7.2 and latest:

```bash

docker pull ghcr.io/kurtserdar/captivo-access-manager:0.7.2

docker pull ghcr.io/kurtserdar/captivo-access-dataplane:0.7.2

docker pull ghcr.io/kurtserdar/captivo-access-connector:0.7.2 # amd64 + arm64

```

New here? Quickstart — a working demo in ~5 minutes with zero DNS. License: Apache-2.0.

Tidy up revoked connectors. You can now delete a connector from the console once it's revoked and has no sites — so retired connectors don't linger in the list.

Highlights

• Delete a revoked, empty connector. On the Connectors page, a revoked connector with no sites gets a Delete button. If it still has sites, the list shows "Revoked · N sites" instead — move or remove those sites (under Sites) first.
• Guarded on the server. Deletion is only ever allowed for a revoked connector with zero sites, enforced in the API — not just the UI. This protects against removing a connector out from under sites and access grants that depend on it. Audit history is unaffected.

Upgrade — trivial

• Manager-only, non-breaking. Pull the new manager image and restart it. No connector/data-plane change, no prisma db push — nothing about the schema changes. (dataplane/connector re-published at 0.7.1 for version parity, identical to 0.7.0.)

Images

Published to GHCR, tagged 0.7.1 and latest:

```bash

docker pull ghcr.io/kurtserdar/captivo-access-manager:0.7.1

docker pull ghcr.io/kurtserdar/captivo-access-dataplane:0.7.1

docker pull ghcr.io/kurtserdar/captivo-access-connector:0.7.1

```

New here? Quickstart — a working demo in ~5 minutes with zero DNS. License: Apache-2.0.

Email is here. Configure SMTP once and Captivo Access will deliver invite links for you — no more copy-paste — and email your admins when something needs attention.

Highlights

• Send invite links by email. When you create an invite, tick "Email the invite link" and the vendor gets it directly. The one-time link is still shown on screen as a fallback.
• Admin notifications by email. Admins are emailed when a Site goes down or recovers, and when a vendor requests access that's waiting for approval — alongside the existing in-console notifications.
• Configured in the console. A new Email settings page (Admin) takes your SMTP host, port, TLS mode, credentials, and a "from" address, with a Send test email button to confirm it works. The password is stored encrypted; email sending is best-effort and never blocks anything if the mail server is down.

Upgrade — one migration step

• Pull the new manager image and restart it. No connector/data-plane change, no re-enrollment. (dataplane/connector re-published at 0.7.0 for version parity, identical to 0.6.1.)
• Run prisma db push to add the new SmtpConfig table — additive and non-destructive.
• Email stays off until you configure and enable it on the Email settings page.

Images

Published to GHCR, tagged 0.7.0 and latest:

```bash

docker pull ghcr.io/kurtserdar/captivo-access-manager:0.7.0

docker pull ghcr.io/kurtserdar/captivo-access-dataplane:0.7.0

docker pull ghcr.io/kurtserdar/captivo-access-connector:0.7.0

```

New here? Quickstart — a working demo in ~5 minutes with zero DNS. License: Apache-2.0.

Fix: the command palette's dim backdrop now covers the whole screen.

Opening the ⌘K / Ctrl+K palette only darkened a thin band near the top instead of the full page behind it — the top bar's blur effect was unintentionally clipping the overlay. The palette overlay now renders at the document root, so the backdrop dims the entire viewport as intended. Purely visual; no behavior change.

Upgrade — trivial

• Manager-only, non-breaking. Pull the new manager image and restart it. No connector/data-plane change, no prisma db push. (dataplane/connector re-published at 0.6.1 for version parity, identical to 0.6.0.)

Images

Published to GHCR, tagged 0.6.1 and latest:

```bash

docker pull ghcr.io/kurtserdar/captivo-access-manager:0.6.1

docker pull ghcr.io/kurtserdar/captivo-access-dataplane:0.6.1

docker pull ghcr.io/kurtserdar/captivo-access-connector:0.6.1

```

New here? Quickstart — a working demo in ~5 minutes with zero DNS. License: Apache-2.0.

Know who you invited. When you invite someone, you can now record their company and phone — captured on the invite, carried onto their account when they enroll, and shown in the Users and Invites lists.

Highlights

• Company + phone on invites. Two new optional fields in the invite form. The phone uses a built-in international picker — a country selector with flags and dial codes (defaults to 🇹🇷), then the number — so you capture it in a clean, consistent format. No third-party library.
• Carried onto the account. Whatever you enter is stored on the invite and copied onto the user's record the moment they complete enrollment.
• Visible where you manage people. The Users and Invites lists gain a Company column, with the phone shown beneath it.
• Fully optional. Leave either blank and the invite works exactly as before — nothing is required.

Upgrade — one migration step

This release adds four nullable columns (phone/company on invites and users).

1. Pull the new manager image and restart it. No connector or data-plane change, no re-enrollment. (dataplane/connector are re-published at 0.6.0 for version parity, behaviorally identical to 0.5.0.)

2. Run prisma db push to add the new columns — additive and non-destructive (no data is touched). If you deploy with the bundled compose, run it once against your database after pulling.

Images

Published to GHCR, tagged 0.6.0 and latest:

```bash

docker pull ghcr.io/kurtserdar/captivo-access-manager:0.6.0

docker pull ghcr.io/kurtserdar/captivo-access-dataplane:0.6.0

docker pull ghcr.io/kurtserdar/captivo-access-connector:0.6.0

```

New here? Quickstart — a working demo in ~5 minutes with zero DNS. License: Apache-2.0.

Find anything, fast. The console gets a top bar and a command palette — press ⌘K (or Ctrl+K) anywhere and jump straight to a page, site, connector, or user.

Highlights

• Command palette (⌘K / Ctrl+K). A keyboard-first launcher over the whole console. Start typing to filter — pages you can open, and your Sites (by name or hostname), Connectors, and Users. Arrow keys to move, Enter to go, Esc to dismiss. There's a search box in the top bar too, if you'd rather click.
• Top bar. Every screen now has a slim header showing the current page, with the search box on the right.
• Instant, private. Search runs entirely in your browser against a lightweight index the console already loads — no per-keystroke server round-trips, and vendors only ever see the pages they're allowed to reach.

This completes a three-part polish pass — a real dashboard (0.4.1), a proper brand identity (0.4.2), and now console-wide navigation.

Upgrade — trivial

• Manager-only, non-breaking. Pull the new manager image and restart it. No connector or data-plane change, no re-enrollment, and no prisma db push — nothing about the schema or data changes.
• The dataplane and connector images are re-published at 0.5.0 for version parity but are behaviorally identical to 0.4.2.

Images

Published to GHCR, tagged 0.5.0 and latest:

```bash

docker pull ghcr.io/kurtserdar/captivo-access-manager:0.5.0

docker pull ghcr.io/kurtserdar/captivo-access-dataplane:0.5.0

docker pull ghcr.io/kurtserdar/captivo-access-connector:0.5.0

```

New here? Quickstart — a working demo in ~5 minutes with zero DNS. License: Apache-2.0.